@crewhaus/spec-patch 0.5.7 → 0.6.0

package/dist/index.d.ts

@@ -117,10 +117,12 @@ export type SpecEdit = {
 };
 export type ApplySpecEditsOptions = {
     /**
-     * The optimizer surface: every edit path must fall under the spec target's
-     * `OPTIMIZABLE_PATHS` whitelist (exact or prefix match, same rule as
-     * `validatePatch`). Author surfaces leave this off and may edit any field —
-     * the atomic `parseSpec` re-validation is their safety floor.
+     * The optimizer surface: every edit path must be admitted by the spec
+     * target's `OPTIMIZABLE_PATHS` whitelist through {@link isOptimizable} —
+     * exact match (wildcards = one segment each), the structural
+     * `model_pool` / `judge` / `sub_agents` / `temperature` rule, then prefix;
+     * the same rule as `validatePatch`. Author surfaces leave this off and may
+     * edit any field — the atomic `parseSpec` re-validation is their safety floor.
      */
     readonly restrictToOptimizable?: boolean;
 };
@@ -144,6 +146,29 @@ export type ApplySpecEditsResult = {
  * byte-identical (no CST round-trip reformatting).
  */
 export declare function applySpecEdits(yamlText: string, edits: ReadonlyArray<SpecEdit>, opts?: ApplySpecEditsOptions): ApplySpecEditsResult;
+/**
+ * 0.6.0 (plan §10.3, mechanism 1) — the WILDCARD segment. Inside an
+ * `OPTIMIZABLE_PATHS` entry, `"*"` matches EXACTLY ONE key segment of the
+ * patched path (a `models:` profile name, a `steps` index, a `nodes` / `roles`
+ * name, a `rules` index) — never zero segments, never more than one, never a
+ * literal `"*"` key. Two placement rules make the wildcard safe, pinned by
+ * {@link wildcardPlacementIssues} (a CI guard, not a load-time throw):
+ *
+ *   1. a wildcard is never the LAST segment — `["models","*"]` would admit a
+ *      whole profile (its `model`, `tools`, `permissions`, …) by prefix;
+ *   2. a wildcard never sits ABOVE a human-owned key — the concrete tail after
+ *      the last `"*"` must end in a dial, never in one of
+ *      {@link WILDCARD_FORBIDDEN_LEAVES} (the identity / security / prompt keys
+ *      the §10.3 table excludes) and never in a structural segment.
+ */
+export declare const WILDCARD_SEGMENT = "*";
+/**
+ * Keys a wildcard-bearing entry may never terminate in: the §10.3 exclusions
+ * that live UNDER a dynamic key (`models.<name>`, `candidates[i]`,
+ * `rules[i]`, `sub_agents.<name>`). A dial entry that ended in one of these
+ * would whitelist identity or security surface across every profile at once.
+ */
+export declare const WILDCARD_FORBIDDEN_LEAVES: ReadonlyArray<string>;
 /**
  * Per-target whitelist of mutation paths the active optimizer is
  * allowed to touch. Adding a new field here is the explicit signal that
@@ -169,6 +194,127 @@ export declare function applySpecEdits(yamlText: string, edits: ReadonlyArray<Sp
  * reason: there is no whitelisted path for it to patch.
  */
 export declare const OPTIMIZABLE_PATHS: Readonly<Record<Spec["target"], ReadonlyArray<ReadonlyArray<string>>>>;
+/**
+ * 0.6.0 (plan §10.3, mechanism 2) — the STRUCTURAL rule: a path that passes
+ * through any of these segments is optimizable only by EXACT match against a
+ * listed entry, never by prefix. The whole-block entries `["steps"]`,
+ * `["nodes"]` and `["roles"]` exist because the step index / node name / role
+ * name is positional, and whole-block replacement was meant to span
+ * `model`/`instructions` — not the human-owned structure that now hangs off
+ * every routed block:
+ *
+ *   - `model_pool` — the candidate ROSTER (mirroring the standing
+ *     `["agent","model"]` exclusion), and from 0.6.0 the hybrid container:
+ *     `rules.*.use` (rule targets), `strategy.*` role slots and
+ *     `model_directed` (registers the `Escalate`/`Consult` tool surface),
+ *     `reward.*` (the floor), `directives` (admits user-directed input),
+ *     `classifier.{model,labels}` (judge identity), `scope`. The plan's
+ *     verdict table classifies every one of these as excluded.
+ *   - `judge` — a `kind: judge` gate's `escalate_to` (a routing target),
+ *     `judges` (judge identity), `temperature`/`target`.
+ *   - `sub_agents` — a sub-agent definition is a tool-surface / identity block
+ *     (`tools`, `permissions`, `model`, `inherit_bypass`, and from 0.6.0
+ *     `allowed_profiles`, `budget_share`, `inherit_routing`, its own routing).
+ *   - `temperature` — a quality dial the plan lists as optimizable, but ONLY
+ *     via the exact entries (`["agent","temperature"]`, the per-step / node /
+ *     role wildcard entries, `models.*.temperature`): every OTHER
+ *     `temperature` leaf — a candidate's, a sub-agent's, a judge's pinned
+ *     sampling temperature — is human-owned, and a prefix-reached patch
+ *     would land on one of those.
+ *   - `model_tiers`, `model_fallbacks`, `circuit_breaker` — the three
+ *     pre-pool routing blocks (§11.1 adds them to graph nodes and sub-agents
+ *     in 0.6.0; steps and roles carried them before). `model_tiers` is a
+ *     two-slot roster (`fast`/`default` are model identity, mirroring the
+ *     standing `agent.model` exclusion), `model_fallbacks` is the failover
+ *     chain and `circuit_breaker` decides when an arm is withdrawn from
+ *     service — the same verdicts the §10.3 table gives their `models.*`
+ *     twins. No exact entry names any of them, so the rule closes the
+ *     whole-block prefix route (`["nodes"]` → `nodes.a.circuit_breaker`)
+ *     without removing anything the table promises.
+ *
+ * One rule, no negative-list semantics: the exact entries
+ * `["agent","model_pool",{policy,routing,learning}]` keep working, and a
+ * whole-block `["steps"]` replacement (whose PATH carries none of these
+ * segments) is unchanged. The wildcard segment ({@link WILDCARD_SEGMENT}) and
+ * the exact entries the §10.3 table promises (`poolDials`, `judgeGateDials`,
+ * `MODEL_PROFILE_DIALS`) ride on top of this rule — it is what makes that
+ * table true for the positional shapes. Note the reconciliation the exact
+ * match performs: `["agent","temperature"]` IS listed, so the structural
+ * `temperature` segment blocks only the prefix route, never the entry.
+ */
+export declare const STRUCTURAL_SEGMENTS: ReadonlyArray<string>;
+/**
+ * 0.6.0 §10.3 — the EXCLUDED half of the verdict table, stated in code rather
+ * than left to the whitelist's default-deny (the 0.3.0 discipline). Each row
+ * is a segment pattern matched as a CONTIGUOUS sub-sequence ANYWHERE in a leaf
+ * path (`"*"` = any one segment), so one row covers the same key on every
+ * host: `["model_pool","rules","*","use"]` excludes `agent.model_pool.rules[i].use`
+ * on cli and `steps[i].model_pool.rules[j].use` on workflow alike. A row that
+ * names a block (`["model_pool","candidates"]`) excludes every leaf under it.
+ *
+ * This table is NOT consulted by {@link isOptimizable} — the whitelist is the
+ * only admission rule, and anything it does not list is refused. The rows
+ * exist so the table's closing invariant can be TESTED: every leaf the
+ * 0.6.0 spec delta introduced (enumerated from the zod schema) must be
+ * classified exactly once — matched by the whitelist XOR by a row here — and
+ * the test fails on a leaf that is unclassified or claimed twice, so this
+ * table, the whitelist and the schema cannot drift apart. The Hangar spec
+ * editor and `crewhaus advise` read the reasons.
+ */
+export declare const HUMAN_OWNED_PATHS: ReadonlyArray<{
+    readonly pattern: ReadonlyArray<string>;
+    readonly reason: string;
+}>;
+/** A leaf path is human-owned when some {@link HUMAN_OWNED_PATHS} row matches it. */
+export declare function humanOwnedReason(path: ReadonlyArray<SpecEditPathSegment>): string | undefined;
+/**
+ * The wildcard placement guard (plan §10.3, mechanism 1): every issue is a
+ * whitelist entry that would let `"*"` sit above a human-owned key. Returns
+ * `[]` for the shipped table — pinned by the spec-patch tests, so a future
+ * entry that breaks the rule fails CI rather than widening the surface.
+ */
+export declare function wildcardPlacementIssues(table?: Readonly<Record<string, ReadonlyArray<ReadonlyArray<string>>>>): string[];
+/**
+ * The single admission rule behind `validatePatch`, `applySpecEdits({
+ * restrictToOptimizable })`, the Hangar spec editor's trust badge, the
+ * feedback / watch-me advice tiers and the orchestrator's stage guard:
+ *
+ *   1. an EXACT match against a listed entry admits the path (wildcards
+ *      match one segment each);
+ *   2. a path through a STRUCTURAL segment ({@link STRUCTURAL_SEGMENTS}) is
+ *      admitted by exact match ONLY — never by prefix;
+ *   3. otherwise a listed entry that is a PREFIX of the path admits it
+ *      (`["nodes","0","instructions"]` under `["nodes"]`), so the optimizer
+ *      can make fine-grained updates without listing every sub-path.
+ *
+ * Exported so every consumer shares one matcher — a hand-rolled prefix copy
+ * would neither honour the wildcard nor close the structural leak.
+ */
+/**
+ * 0.6.0 §6.1 (PR 12) — the leaves the whitelist admits BY PREFIX but the
+ * optimizer must never move, matched as a contiguous sub-sequence anywhere in
+ * a path (the {@link HUMAN_OWNED_PATHS} matcher) and ENFORCED by
+ * {@link isOptimizable}.
+ *
+ * There is exactly one row, and it exists because `model_pool.learning` is
+ * deliberately whitelisted WHOLESALE: `crewhaus advise` mines the reward
+ * scoreboard into that block and patches it AS a block, so a narrower
+ * enumeration would break the advisor. PR 19 shipped the verdict table with
+ * the `learning.seed` exclusion documented as an accepted gap "until the eval
+ * runner (PR 12) needs it"; it needs it now — a routed eval PINS
+ * `learning.seed`, so an optimizer free to patch the seed could produce a
+ * measured delta of guaranteed zero, the one mutation that always "wins"
+ * because it changes nothing the measurement can see.
+ *
+ * This is an enforcement narrower than the whitelist, NOT a second
+ * classification: the `learning` BLOCK stays legitimately optimizable (which
+ * is what §10.3's verdict table and its closing-invariant test record), and
+ * `validatePatch` additionally refuses a block patch that would CHANGE the
+ * seed — a block patch that preserves it, as the advisor's spread does,
+ * passes.
+ */
+export declare const OPTIMIZER_REFUSED_LEAVES: ReadonlyArray<ReadonlyArray<string>>;
+export declare function isOptimizable(target: Spec["target"], path: ReadonlyArray<SpecEditPathSegment>): boolean;
 /**
  * Format a YAML header comment to prepend to a written-back file. The
  * orchestrator's `--write-back` writes this above the original spec so

package/dist/index.js

@@ -148,6 +148,52 @@ export function validatePatch(spec, patch) {
     if (!isOptimizable(spec.target, patch.path)) {
         throw new SpecPatchError(`path ${formatPath(patch.path)} is not listed in OPTIMIZABLE_PATHS for target "${spec.target}"; add it to packages/spec-patch/src/index.ts if it's intended to be tunable`);
     }
+    // 0.6.0 §6.1 — the block-level way around `OPTIMIZER_REFUSED_LEAVES`:
+    // `model_pool.learning` is whitelisted WHOLESALE (the advisor patches the
+    // block), so a patch at the block carrying a `seed` key would move a leaf
+    // the path check just refused. A routed eval pins that seed; a patch to it
+    // would produce a measured delta of guaranteed zero.
+    const moved = refusedBlockValueKey(spec, patch.path, patch.value);
+    if (moved !== undefined) {
+        throw new SpecPatchError(`patch at ${formatPath(patch.path)} would change "${moved}", which is not optimizable: a routed eval PINS model_pool.learning.seed, so a patch to it measures a guaranteed-zero delta. Re-issue the block patch carrying the spec's existing seed (a block patch that PRESERVES it is fine).`);
+    }
+}
+/**
+ * The refused LEAF a block-level patch's value would CHANGE, when the patch
+ * lands on the parent block of an {@link OPTIMIZER_REFUSED_LEAVES} row.
+ *
+ * Deliberately "change", not "carry": `crewhaus advise`'s pool rules propose a
+ * whole-`learning`-block replace built by SPREADING the spec's current block,
+ * so a preserved seed must pass. Only adding, removing or altering the value
+ * is refused — the residual the path-level check cannot see.
+ */
+function refusedBlockValueKey(spec, path, value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const segs = path.map((s) => String(s));
+    for (const pattern of OPTIMIZER_REFUSED_LEAVES) {
+        const parent = pattern.slice(0, -1);
+        const leaf = pattern[pattern.length - 1];
+        const endsWithParent = segs.length >= parent.length &&
+            parent.every((p, i) => segs[segs.length - parent.length + i] === p);
+        if (!endsWithParent)
+            continue;
+        const proposed = value[leaf];
+        const current = readSpecPath(spec, [...path, leaf]);
+        if (proposed !== current)
+            return `${segs.join(".")}.${leaf}`;
+    }
+    return undefined;
+}
+/** Read a plain path out of a parsed spec. `undefined` for any missing segment. */
+function readSpecPath(spec, path) {
+    let cur = spec;
+    for (const seg of path) {
+        if (cur === null || typeof cur !== "object")
+            return undefined;
+        cur = cur[String(seg)];
+    }
+    return cur;
 }
 function formatPath(path) {
     return path.join(".");
@@ -281,6 +327,135 @@ function formatEditPath(path) {
     }
     return out;
 }
+/**
+ * 0.6.0 (plan §10.3, mechanism 1) — the WILDCARD segment. Inside an
+ * `OPTIMIZABLE_PATHS` entry, `"*"` matches EXACTLY ONE key segment of the
+ * patched path (a `models:` profile name, a `steps` index, a `nodes` / `roles`
+ * name, a `rules` index) — never zero segments, never more than one, never a
+ * literal `"*"` key. Two placement rules make the wildcard safe, pinned by
+ * {@link wildcardPlacementIssues} (a CI guard, not a load-time throw):
+ *
+ *   1. a wildcard is never the LAST segment — `["models","*"]` would admit a
+ *      whole profile (its `model`, `tools`, `permissions`, …) by prefix;
+ *   2. a wildcard never sits ABOVE a human-owned key — the concrete tail after
+ *      the last `"*"` must end in a dial, never in one of
+ *      {@link WILDCARD_FORBIDDEN_LEAVES} (the identity / security / prompt keys
+ *      the §10.3 table excludes) and never in a structural segment.
+ */
+export const WILDCARD_SEGMENT = "*";
+/**
+ * Keys a wildcard-bearing entry may never terminate in: the §10.3 exclusions
+ * that live UNDER a dynamic key (`models.<name>`, `candidates[i]`,
+ * `rules[i]`, `sub_agents.<name>`). A dial entry that ended in one of these
+ * would whitelist identity or security surface across every profile at once.
+ */
+export const WILDCARD_FORBIDDEN_LEAVES = Object.freeze([
+    "model",
+    "models",
+    "tags",
+    "tools",
+    "tool_config",
+    "permissions",
+    "rate_limits",
+    "cost",
+    "requires",
+    "capabilities",
+    "fallbacks",
+    "circuit_breaker",
+    "instructions",
+    "caching",
+    "candidates",
+    "when",
+    "use",
+    "labels",
+    "reward",
+    "directives",
+    "model_directed",
+    "allowed_profiles",
+    "inherit_routing",
+    "budget_share",
+    "tool_flags",
+    "escalate_to",
+    "judges",
+    "criteria",
+    "on_fail",
+    "seed",
+]);
+/**
+ * 0.6.0 §10.3 — the per-profile DIALS: quality/cost knobs with no identity,
+ * security or routing meaning, tunable on every `models:` profile of every
+ * shape (`models:` is attached to all 14 schemas). `thinking.budget_tokens`
+ * follows the standing rule for the agent block — the budget is a dial, the
+ * thinking FORM (`effort`) stays human-owned. Every other profile field
+ * (`model`, `tags`, `tools`, `tool_config`, `permissions`, `rate_limits`,
+ * `cost`, `requires`, `capabilities`, `fallbacks`, `circuit_breaker`,
+ * `instructions`, `caching`) is EXCLUDED — see {@link HUMAN_OWNED_PATHS}.
+ */
+const MODEL_PROFILE_DIALS = Object.freeze([
+    Object.freeze(["models", WILDCARD_SEGMENT, "max_tokens"]),
+    Object.freeze(["models", WILDCARD_SEGMENT, "thinking", "budget_tokens"]),
+    Object.freeze(["models", WILDCARD_SEGMENT, "temperature"]),
+    Object.freeze(["models", WILDCARD_SEGMENT, "limits", "model_call_timeout_ms"]),
+]);
+/**
+ * 0.6.0 §10.3 — the `model_pool` entries for one routed block (`agent`, a
+ * `steps[*]` step, a `nodes.*` node, a `roles.*` role). Because the
+ * structural rule ({@link STRUCTURAL_SEGMENTS}) admits a `model_pool` path
+ * ONLY by exact match, every tunable pool key needs its own entry — nothing
+ * under `model_pool` is reached by prefix any more, on any shape:
+ *
+ *   - `policy` / `routing` / `learning` — the pre-0.6.0 policy knobs
+ *     (`routing` and `learning` deliberately WHOLESALE: `advise` mines the
+ *     scoreboard into them). On the positional shapes these were reached by
+ *     the whole-block `["steps"]` / `["nodes"]` / `["roles"]` prefix until the
+ *     structural rule closed prefix reach into `model_pool`; the exact
+ *     wildcard entries restore exactly the G37 intent and nothing more.
+ *   - `rules[*].enabled` — a switch, not a target (`rules[*].when` / `.use`
+ *     / `.id` stay human-owned).
+ *   - `strategy.shadow.sample_rate`, `strategy.guide.max_tokens`,
+ *     `strategy.max_escalations`, `classifier.max_tokens` — pure cost dials.
+ *   - `strategy.cascade.clean_prompt` — a prompt-shape dial (draft kept or
+ *     dropped before the escalation re-run).
+ *
+ * `candidates` (incl. `enabled`), `rules[*].{when,use,id}`,
+ * `classifier.{model,labels}`, every `strategy.*` role / model slot,
+ * `strategy.model_directed`, `reward.*`, `directives`, `scope` and
+ * `objective` are EXCLUDED — see {@link HUMAN_OWNED_PATHS}.
+ */
+function poolDials(block) {
+    const pool = [...block, "model_pool"];
+    return Object.freeze([
+        Object.freeze([...pool, "policy"]),
+        Object.freeze([...pool, "routing"]),
+        Object.freeze([...pool, "learning"]),
+        Object.freeze([...pool, "rules", WILDCARD_SEGMENT, "enabled"]),
+        Object.freeze([...pool, "strategy", "shadow", "sample_rate"]),
+        Object.freeze([...pool, "strategy", "guide", "max_tokens"]),
+        Object.freeze([...pool, "strategy", "max_escalations"]),
+        Object.freeze([...pool, "strategy", "cascade", "clean_prompt"]),
+        Object.freeze([...pool, "classifier", "max_tokens"]),
+    ]);
+}
+/**
+ * 0.6.0 §10.3 — a `kind: judge` gate's dials on a positional block (`steps[*]`
+ * / `nodes.*`): `threshold` and `max_retries` mirror the agent-shape
+ * `evaluation.threshold` / `evaluation.max_retries` entries (the structural
+ * `judge` segment closed their prefix reach; these restore it exactly), and
+ * `repeats` mirrors `evaluation.grader.repeats`. `criteria`, `model`,
+ * `judges`, `temperature`, `target`, `on_fail` and `escalate_to` are EXCLUDED.
+ */
+function judgeGateDials(block) {
+    const judge = [...block, "judge"];
+    return Object.freeze([
+        Object.freeze([...judge, "threshold"]),
+        Object.freeze([...judge, "max_retries"]),
+        Object.freeze([...judge, "repeats"]),
+    ]);
+}
+const STEP = Object.freeze(["steps", WILDCARD_SEGMENT]);
+const NODE = Object.freeze(["nodes", WILDCARD_SEGMENT]);
+const ROLE = Object.freeze(["roles", WILDCARD_SEGMENT]);
+const AGENT = Object.freeze(["agent"]);
 /**
  * Per-target whitelist of mutation paths the active optimizer is
  * allowed to touch. Adding a new field here is the explicit signal that
@@ -351,9 +526,21 @@ export const OPTIMIZABLE_PATHS = Object.freeze({
         // ["agent","model_pool","candidates"]: the candidate ROSTER is
         // human-owned, mirroring the standing ["agent","model"] exclusion —
         // learning tunes selection within the declared set, never the set.
-        Object.freeze(["agent", "model_pool", "policy"]),
-        Object.freeze(["agent", "model_pool", "routing"]),
-        Object.freeze(["agent", "model_pool", "learning"]),
+        // 0.6.0 §10.3 — the exact pool entries (policy/routing/learning plus the
+        // hybrid dials); see `poolDials`. `["agent","model_pool","routing"]` and
+        // `["agent","model_pool","learning"]` stay WHOLESALE — a narrower
+        // enumeration would break `advise`'s scoreboard mining, which patches the
+        // `learning` BLOCK. §6.1's `learning.seed` exclusion is therefore enforced
+        // beside this table rather than inside it: see OPTIMIZER_REFUSED_LEAVES
+        // (PR 12 closed the gap PR 19 documented).
+        ...poolDials(AGENT),
+        // 0.6.0 §10.3 — `agent.temperature`: a threshold-shaped leaf like the
+        // existing params (exclusive with `thinking` on one block — the spec
+        // refine rejects a patch that lands both, so the optimizer can move one
+        // dial only when the other is absent).
+        Object.freeze(["agent", "temperature"]),
+        // 0.6.0 §10.3 — per-profile dials on every `models:` profile.
+        ...MODEL_PROFILE_DIALS,
         // 0.3.0 memory release (design §7.5, PR 20) — the memory/continuity
         // QUALITY knobs, registered on the five emit-wired memory shapes (cli,
         // channel, managed, research, crew — mirrored below with a pointer to
@@ -396,6 +583,10 @@ export const OPTIMIZABLE_PATHS = Object.freeze({
         // the optimizer tunes how strict the gate is, never what it judges.
         Object.freeze(["evaluation", "threshold"]),
         Object.freeze(["evaluation", "max_retries"]),
+        // 0.6.0 §10.3 — `evaluation.grader.repeats`: a measurement dial (verdicts
+        // per judge, folded by median). `judges`, `temperature`, `target`,
+        // `criteria`, `model` and `on_fail` / `allow_self_judge` stay human-owned.
+        Object.freeze(["evaluation", "grader", "repeats"]),
         // Loop contract 0.4 (Batch E) — the agent-shape RAG (`knowledge:`) dials
         // + the per-turn recall cadence. All scalars that survive lower() 1:1
         // with their bounds owned by the spec schema, so an out-of-bounds patch
@@ -411,12 +602,21 @@ export const OPTIMIZABLE_PATHS = Object.freeze({
         Object.freeze(["memory", "refreshEvery"]),
     ]),
     workflow: Object.freeze([
-        // Whole-step replacement — this ALSO reaches item 9's (G37) per-step
-        // model routing (model_pool policy/routing/learning, tiers, fallbacks):
-        // no narrower entry is possible (the roster/step index is positional) and
-        // whole-step replacement already spans model/instructions, so the policy
-        // knobs ride here rather than as standalone paths.
+        // Whole-step replacement — a whole-step VALUE may carry item 9's (G37)
+        // per-step model routing (a pool-bearing step round-trips, see the G37
+        // tests) because the path `["steps"]` crosses no structural segment.
+        // The sub-path route is narrower: the structural rule stops prefix reach
+        // at `model_pool` / `judge` / `temperature` / `model_tiers` /
+        // `model_fallbacks` / `circuit_breaker`, so `steps[i].model_tiers.fast`
+        // is refused and only the exact dials below are admitted under a step.
         Object.freeze(["steps"]),
+        // 0.6.0 §10.3 — the structural rule closed prefix reach into a step's
+        // `model_pool` / `judge` / `temperature`; these exact wildcard entries
+        // (`*` = one step index) are the dials the table promises per step.
+        ...poolDials(STEP),
+        ...judgeGateDials(STEP),
+        Object.freeze([...STEP, "temperature"]),
+        ...MODEL_PROFILE_DIALS,
         Object.freeze(["failure_taxonomy"]),
         Object.freeze(["chains"]),
         Object.freeze(["transaction_policy"]),
@@ -431,10 +631,10 @@ export const OPTIMIZABLE_PATHS = Object.freeze({
         Object.freeze(["failure_taxonomy"]),
         Object.freeze(["chains"]),
         Object.freeze(["transaction_policy"]),
-        // Adaptive model routing — pool policy knobs only (see the cli entry).
-        Object.freeze(["agent", "model_pool", "policy"]),
-        Object.freeze(["agent", "model_pool", "routing"]),
-        Object.freeze(["agent", "model_pool", "learning"]),
+        // Adaptive model routing + 0.6.0 hybrid dials — see the cli entry.
+        ...poolDials(AGENT),
+        Object.freeze(["agent", "temperature"]),
+        ...MODEL_PROFILE_DIALS,
         // 0.3.0 memory/continuity quality knobs — types/bounds at the cli entry.
         Object.freeze(["memory", "recallK"]),
         Object.freeze(["memory", "autoCaptureThreshold"]),
@@ -445,6 +645,7 @@ export const OPTIMIZABLE_PATHS = Object.freeze({
         // Loop contract 0.4 (Batch B, G40) — evaluation dials; see the cli entry.
         Object.freeze(["evaluation", "threshold"]),
         Object.freeze(["evaluation", "max_retries"]),
+        Object.freeze(["evaluation", "grader", "repeats"]),
         // Loop contract 0.4 (Batch E) — knowledge/recall dials; see the cli entry.
         Object.freeze(["knowledge", "default_k"]),
         Object.freeze(["knowledge", "chunk", "size"]),
@@ -453,6 +654,11 @@ export const OPTIMIZABLE_PATHS = Object.freeze({
     ]),
     graph: Object.freeze([
         Object.freeze(["nodes"]),
+        // 0.6.0 §10.3 — per-node dials (`*` = one node name); see the workflow entry.
+        ...poolDials(NODE),
+        ...judgeGateDials(NODE),
+        Object.freeze([...NODE, "temperature"]),
+        ...MODEL_PROFILE_DIALS,
         Object.freeze(["failure_taxonomy"]),
         Object.freeze(["chains"]),
         Object.freeze(["transaction_policy"]),
@@ -465,10 +671,10 @@ export const OPTIMIZABLE_PATHS = Object.freeze({
         Object.freeze(["agent", "thinking", "budget_tokens"]),
         Object.freeze(["limits", "max_tool_iterations"]),
         Object.freeze(["failure_taxonomy"]),
-        // Adaptive model routing — pool policy knobs only (see the cli entry).
-        Object.freeze(["agent", "model_pool", "policy"]),
-        Object.freeze(["agent", "model_pool", "routing"]),
-        Object.freeze(["agent", "model_pool", "learning"]),
+        // Adaptive model routing + 0.6.0 hybrid dials — see the cli entry.
+        ...poolDials(AGENT),
+        Object.freeze(["agent", "temperature"]),
+        ...MODEL_PROFILE_DIALS,
         // 0.3.0 memory/continuity quality knobs — types/bounds at the cli entry.
         Object.freeze(["memory", "recallK"]),
         Object.freeze(["memory", "autoCaptureThreshold"]),
@@ -479,6 +685,7 @@ export const OPTIMIZABLE_PATHS = Object.freeze({
         // Loop contract 0.4 (Batch B, G40) — evaluation dials; see the cli entry.
         Object.freeze(["evaluation", "threshold"]),
         Object.freeze(["evaluation", "max_retries"]),
+        Object.freeze(["evaluation", "grader", "repeats"]),
         // Loop contract 0.4 (Batch E) — knowledge/recall dials; see the cli entry.
         Object.freeze(["knowledge", "default_k"]),
         Object.freeze(["knowledge", "chunk", "size"]),
@@ -487,18 +694,29 @@ export const OPTIMIZABLE_PATHS = Object.freeze({
     ]),
     pipeline: Object.freeze([
         Object.freeze(["agent", "instructions"]),
+        // 0.6.0 §10.3 — the pipeline agent carries a `model_pool` and a
+        // `temperature` (params/overlay only per §11.3): the same policy knobs
+        // and dials as the cli agent.
+        ...poolDials(AGENT),
+        Object.freeze(["agent", "temperature"]),
+        ...MODEL_PROFILE_DIALS,
         Object.freeze(["failure_taxonomy"]),
         Object.freeze(["indexing", "chunkSize"]),
         Object.freeze(["indexing", "chunkOverlap"]),
         Object.freeze(["retrieve", "defaultK"]),
     ]),
     crew: Object.freeze([
-        // Whole-role replacement — this ALSO reaches item 9's (G37) per-role
-        // model routing (model_pool policy/routing/learning, tiers, fallbacks):
-        // the role name is a dynamic map key, so no static narrower path exists,
-        // and whole-role replacement already spans model/instructions, so the
-        // policy knobs ride here rather than as standalone paths.
+        // Whole-role replacement — a whole-role VALUE may carry item 9's (G37)
+        // per-role model routing (the role name is a dynamic map key; see the
+        // G37 tests). The sub-path route is narrower, as at the workflow entry:
+        // `roles.<r>.model_tiers` / `model_fallbacks` / `circuit_breaker` /
+        // `model_pool.*` are refused by the structural rule; only the exact
+        // dials below are admitted under a role.
         Object.freeze(["roles"]),
+        // 0.6.0 §10.3 — per-role dials (`*` = one role name); see the workflow entry.
+        ...poolDials(ROLE),
+        Object.freeze([...ROLE, "temperature"]),
+        ...MODEL_PROFILE_DIALS,
         Object.freeze(["failure_taxonomy"]),
         Object.freeze(["chains"]),
         Object.freeze(["transaction_policy"]),
@@ -516,6 +734,11 @@ export const OPTIMIZABLE_PATHS = Object.freeze({
     ]) /* whole-role replacement */,
     research: Object.freeze([
         Object.freeze(["agent", "instructions"]),
+        // 0.6.0 §10.3 — the pooled single-agent shapes (research, batch, browser)
+        // carry `agent.model_pool` + `agent.temperature`: same dials as cli.
+        ...poolDials(AGENT),
+        Object.freeze(["agent", "temperature"]),
+        ...MODEL_PROFILE_DIALS,
         Object.freeze(["failure_taxonomy"]),
         // NOTE ["retrieve","maxDepth"] was REMOVED here (Batch A): the research
         // retrieve block never grew a maxDepth field (strict schema rejects
@@ -537,6 +760,10 @@ export const OPTIMIZABLE_PATHS = Object.freeze({
     ]),
     batch: Object.freeze([
         Object.freeze(["agent", "instructions"]),
+        // 0.6.0 §10.3 — see the research entry.
+        ...poolDials(AGENT),
+        Object.freeze(["agent", "temperature"]),
+        ...MODEL_PROFILE_DIALS,
         Object.freeze(["failure_taxonomy"]),
         Object.freeze(["chains"]),
         Object.freeze(["transaction_policy"]),
@@ -545,21 +772,32 @@ export const OPTIMIZABLE_PATHS = Object.freeze({
     ]),
     voice: Object.freeze([
         Object.freeze(["agent", "instructions"]),
+        // 0.6.0 §10.3 — `models:` is attached to every shape; the profile dials
+        // are the only 0.6.0 entries here (voice has no pool and no temperature).
+        ...MODEL_PROFILE_DIALS,
         Object.freeze(["failure_taxonomy"]),
     ]),
     browser: Object.freeze([
         Object.freeze(["agent", "instructions"]),
+        // 0.6.0 §10.3 — see the research entry.
+        ...poolDials(AGENT),
+        Object.freeze(["agent", "temperature"]),
+        ...MODEL_PROFILE_DIALS,
         Object.freeze(["failure_taxonomy"]),
         // Loop contract 0.4 (Batch A) — see the cli entry.
         Object.freeze(["limits", "max_tool_iterations"]),
     ]),
     eval: Object.freeze([
         Object.freeze(["agent", "instructions"]),
+        // 0.6.0 §10.3 — profile dials only (see the voice entry).
+        ...MODEL_PROFILE_DIALS,
         Object.freeze(["failure_taxonomy"]),
     ]),
     // §47 onchain daemon: full cross-cutting blocks are optimizable.
     onchain: Object.freeze([
         Object.freeze(["agent", "instructions"]),
+        // 0.6.0 §10.3 — profile dials only (see the voice entry).
+        ...MODEL_PROFILE_DIALS,
         Object.freeze(["failure_taxonomy"]),
         Object.freeze(["chains"]),
         Object.freeze(["triggers"]),
@@ -570,41 +808,438 @@ export const OPTIMIZABLE_PATHS = Object.freeze({
     // the productive knobs; move-timeout-ms is the realtime quality knob.
     "onchain-game": Object.freeze([
         Object.freeze(["agent", "instructions"]),
+        // 0.6.0 §10.3 — profile dials only (see the voice entry).
+        ...MODEL_PROFILE_DIALS,
         Object.freeze(["failure_taxonomy"]),
         Object.freeze(["game"]),
         Object.freeze(["transaction_policy"]),
     ]),
 });
-function isOptimizable(target, path) {
-    const allowed = OPTIMIZABLE_PATHS[target];
-    for (const ok of allowed) {
-        if (ok.length !== path.length)
-            continue;
-        let match = true;
-        for (let i = 0; i < ok.length; i++) {
-            if (ok[i] !== path[i]) {
-                match = false;
-                break;
+/**
+ * 0.6.0 (plan §10.3, mechanism 2) — the STRUCTURAL rule: a path that passes
+ * through any of these segments is optimizable only by EXACT match against a
+ * listed entry, never by prefix. The whole-block entries `["steps"]`,
+ * `["nodes"]` and `["roles"]` exist because the step index / node name / role
+ * name is positional, and whole-block replacement was meant to span
+ * `model`/`instructions` — not the human-owned structure that now hangs off
+ * every routed block:
+ *
+ *   - `model_pool` — the candidate ROSTER (mirroring the standing
+ *     `["agent","model"]` exclusion), and from 0.6.0 the hybrid container:
+ *     `rules.*.use` (rule targets), `strategy.*` role slots and
+ *     `model_directed` (registers the `Escalate`/`Consult` tool surface),
+ *     `reward.*` (the floor), `directives` (admits user-directed input),
+ *     `classifier.{model,labels}` (judge identity), `scope`. The plan's
+ *     verdict table classifies every one of these as excluded.
+ *   - `judge` — a `kind: judge` gate's `escalate_to` (a routing target),
+ *     `judges` (judge identity), `temperature`/`target`.
+ *   - `sub_agents` — a sub-agent definition is a tool-surface / identity block
+ *     (`tools`, `permissions`, `model`, `inherit_bypass`, and from 0.6.0
+ *     `allowed_profiles`, `budget_share`, `inherit_routing`, its own routing).
+ *   - `temperature` — a quality dial the plan lists as optimizable, but ONLY
+ *     via the exact entries (`["agent","temperature"]`, the per-step / node /
+ *     role wildcard entries, `models.*.temperature`): every OTHER
+ *     `temperature` leaf — a candidate's, a sub-agent's, a judge's pinned
+ *     sampling temperature — is human-owned, and a prefix-reached patch
+ *     would land on one of those.
+ *   - `model_tiers`, `model_fallbacks`, `circuit_breaker` — the three
+ *     pre-pool routing blocks (§11.1 adds them to graph nodes and sub-agents
+ *     in 0.6.0; steps and roles carried them before). `model_tiers` is a
+ *     two-slot roster (`fast`/`default` are model identity, mirroring the
+ *     standing `agent.model` exclusion), `model_fallbacks` is the failover
+ *     chain and `circuit_breaker` decides when an arm is withdrawn from
+ *     service — the same verdicts the §10.3 table gives their `models.*`
+ *     twins. No exact entry names any of them, so the rule closes the
+ *     whole-block prefix route (`["nodes"]` → `nodes.a.circuit_breaker`)
+ *     without removing anything the table promises.
+ *
+ * One rule, no negative-list semantics: the exact entries
+ * `["agent","model_pool",{policy,routing,learning}]` keep working, and a
+ * whole-block `["steps"]` replacement (whose PATH carries none of these
+ * segments) is unchanged. The wildcard segment ({@link WILDCARD_SEGMENT}) and
+ * the exact entries the §10.3 table promises (`poolDials`, `judgeGateDials`,
+ * `MODEL_PROFILE_DIALS`) ride on top of this rule — it is what makes that
+ * table true for the positional shapes. Note the reconciliation the exact
+ * match performs: `["agent","temperature"]` IS listed, so the structural
+ * `temperature` segment blocks only the prefix route, never the entry.
+ */
+export const STRUCTURAL_SEGMENTS = Object.freeze([
+    "model_pool",
+    "judge",
+    "sub_agents",
+    "temperature",
+    "model_tiers",
+    "model_fallbacks",
+    "circuit_breaker",
+]);
+/**
+ * 0.6.0 §10.3 — the EXCLUDED half of the verdict table, stated in code rather
+ * than left to the whitelist's default-deny (the 0.3.0 discipline). Each row
+ * is a segment pattern matched as a CONTIGUOUS sub-sequence ANYWHERE in a leaf
+ * path (`"*"` = any one segment), so one row covers the same key on every
+ * host: `["model_pool","rules","*","use"]` excludes `agent.model_pool.rules[i].use`
+ * on cli and `steps[i].model_pool.rules[j].use` on workflow alike. A row that
+ * names a block (`["model_pool","candidates"]`) excludes every leaf under it.
+ *
+ * This table is NOT consulted by {@link isOptimizable} — the whitelist is the
+ * only admission rule, and anything it does not list is refused. The rows
+ * exist so the table's closing invariant can be TESTED: every leaf the
+ * 0.6.0 spec delta introduced (enumerated from the zod schema) must be
+ * classified exactly once — matched by the whitelist XOR by a row here — and
+ * the test fails on a leaf that is unclassified or claimed twice, so this
+ * table, the whitelist and the schema cannot drift apart. The Hangar spec
+ * editor and `crewhaus advise` read the reasons.
+ */
+export const HUMAN_OWNED_PATHS = Object.freeze([
+    // -- the roster (already excluded today; the 0.6.0 per-candidate fields
+    //    ride inside it, including `enabled`) --
+    {
+        pattern: ["agent", "model"],
+        reason: "the model roster is human-owned (the standing agent.model exclusion)",
+    },
+    {
+        pattern: ["model_pool", "candidates"],
+        reason: "the candidate roster — every inline profile field and `enabled` included — is human-owned; learning tunes selection within the declared set, never the set",
+    },
+    {
+        pattern: ["model_pool", "objective"],
+        reason: "the reward weights decide the quality/cost/latency trade-off the learner optimises — a spend policy, not a dial (sibling of reward)",
+    },
+    // -- the pre-pool routing blocks on every routed host (agent, steps[i],
+    //    nodes.<n>, roles.<r>, sub_agents.<n>): roster, failover, withdrawal --
+    {
+        pattern: ["model_tiers"],
+        reason: "the two-tier router is a two-slot roster (fast/default are model identity) plus its thresholds — human-owned like agent.model; the pool's exact routing entry is the tunable generalisation",
+    },
+    {
+        pattern: ["model_fallbacks"],
+        reason: "the failover chain decides which model answers when the primary is down",
+    },
+    {
+        pattern: ["circuit_breaker"],
+        reason: "the breaker decides when an arm is withdrawn from service",
+    },
+    // -- models.<name>: identity, security surface, routing semantics, prompt --
+    {
+        pattern: ["models", "*", "model"],
+        reason: "a profile's model is identity — the roster is never auto-patched",
+    },
+    {
+        pattern: ["models", "*", "tags"],
+        reason: "tags decide what `strong` means: the default floor arm and the target of `strongest`",
+    },
+    {
+        pattern: ["models", "*", "tools"],
+        reason: "a profile's toolset is tool surface — security, not quality",
+    },
+    { pattern: ["models", "*", "tool_config"], reason: "tool config decides what tools may reach" },
+    {
+        pattern: ["models", "*", "permissions"],
+        reason: "permissions are the security floor; a profile may only narrow them, and only a human decides how",
+    },
+    {
+        pattern: ["models", "*", "rate_limits"],
+        reason: "rate limits are a spend / abuse control, never a quality dial",
+    },
+    { pattern: ["models", "*", "cost"], reason: "a per-profile spend cap is human-owned policy" },
+    {
+        pattern: ["models", "*", "requires"],
+        reason: "capability requirements are routing semantics (N1 eligibility)",
+    },
+    {
+        pattern: ["models", "*", "capabilities"],
+        reason: "a declared capability override is a fact about a model, not a dial",
+    },
+    {
+        pattern: ["models", "*", "fallbacks"],
+        reason: "the failover chain decides which provider answers when the first is down",
+    },
+    {
+        pattern: ["models", "*", "circuit_breaker"],
+        reason: "the breaker decides when an arm is withdrawn from service",
+    },
+    {
+        pattern: ["models", "*", "instructions"],
+        reason: "prompt text stays human-owned like evaluation.grader — an accepted inconsistency with agent.instructions, documented rather than widened",
+    },
+    {
+        pattern: ["models", "*", "caching"],
+        reason: "cache posture is a cost/latency contract with the provider, classified explicitly",
+    },
+    {
+        pattern: ["models", "*", "thinking", "effort"],
+        reason: "the thinking FORM stays human-owned (only the explicit budget is a dial — the standing agent.thinking rule)",
+    },
+    // -- model_pool: rule targets, judge identity, the floor, the two switches
+    //    that admit model- or user-directed input --
+    { pattern: ["model_pool", "rules", "*", "id"], reason: "a rule id is persisted identity" },
+    {
+        pattern: ["model_pool", "rules", "*", "when"],
+        reason: "a rule's condition decides which turns leave the cheap lane — a routing target, human-owned",
+    },
+    {
+        pattern: ["model_pool", "rules", "*", "use"],
+        reason: "a rule's target names which arm serves — the roster decision, human-owned",
+    },
+    { pattern: ["model_pool", "classifier", "model"], reason: "judge identity" },
+    {
+        pattern: ["model_pool", "classifier", "labels"],
+        reason: "the label text is the classifier's prompt and its verdict vocabulary",
+    },
+    {
+        pattern: ["model_pool", "strategy", "cascade", "draft"],
+        reason: "a strategy role slot names a roster member",
+    },
+    {
+        pattern: ["model_pool", "strategy", "cascade", "escalate_to"],
+        reason: "a strategy role slot names a roster member",
+    },
+    { pattern: ["model_pool", "strategy", "guide", "model"], reason: "a strategy model slot" },
+    {
+        pattern: ["model_pool", "strategy", "guide", "every"],
+        reason: "guide cadence decides a transcript-cache rewrite per turn — classified explicitly",
+    },
+    {
+        pattern: ["model_pool", "strategy", "guide", "budget_usd"],
+        reason: "a spend cap is human-owned policy",
+    },
+    {
+        pattern: ["model_pool", "strategy", "shadow", "candidate"],
+        reason: "the audition candidate is a roster decision",
+    },
+    { pattern: ["model_pool", "strategy", "shadow", "grade_with"], reason: "judge identity" },
+    {
+        pattern: ["model_pool", "strategy", "committee"],
+        reason: "committee membership, its judge and its tie-breaker are roster and judge identity",
+    },
+    {
+        pattern: ["model_pool", "strategy", "model_directed"],
+        reason: "registers the Escalate / Consult tools — a tool-surface decision that admits model-directed input",
+    },
+    {
+        pattern: ["model_pool", "reward"],
+        reason: "the reward block (quality source, priors, the floor, reset) bounds what the learner may exploit — never tuned by the loop it bounds",
+    },
+    {
+        pattern: ["model_pool", "directives"],
+        reason: "admits user-directed per-message steering — a trust-boundary switch",
+    },
+    {
+        pattern: ["model_pool", "scope"],
+        reason: "the scoped routeKey prefix is arm identity (stamped by the compiler)",
+    },
+    // -- evaluation / judge gates: what is judged and by whom --
+    {
+        pattern: ["evaluation", "grader", "type"],
+        reason: "the grader kind is human-owned semantics (the optimizer tunes how strict the gate is, never what it judges)",
+    },
+    { pattern: ["evaluation", "grader", "criteria"], reason: "prompt text — what the judge judges" },
+    {
+        pattern: ["evaluation", "grader", "value"],
+        reason: "a deterministic grader's match rule is what it judges",
+    },
+    { pattern: ["evaluation", "grader", "model"], reason: "judge identity" },
+    { pattern: ["evaluation", "grader", "judges"], reason: "judge identity (the panel)" },
+    {
+        pattern: ["evaluation", "grader", "temperature"],
+        reason: "the judge's pinned sampling temperature is measurement integrity, not a quality dial",
+    },
+    {
+        pattern: ["evaluation", "grader", "target"],
+        reason: "what the judge grades (output vs trajectory) is measurement semantics",
+    },
+    {
+        pattern: ["evaluation", "on_fail"],
+        reason: "the below-threshold behaviour (incl. escalate) is human-owned semantics",
+    },
+    {
+        pattern: ["evaluation", "allow_self_judge"],
+        reason: "a measurement-integrity waiver, never a knob",
+    },
+    { pattern: ["judge", "criteria"], reason: "prompt text — what the gate judges" },
+    { pattern: ["judge", "model"], reason: "judge identity" },
+    { pattern: ["judge", "judges"], reason: "judge identity (the panel)" },
+    {
+        pattern: ["judge", "temperature"],
+        reason: "the judge's pinned sampling temperature is measurement integrity",
+    },
+    { pattern: ["judge", "target"], reason: "what the gate grades is measurement semantics" },
+    {
+        pattern: ["judge", "on_fail"],
+        reason: "the below-threshold behaviour is human-owned semantics",
+    },
+    {
+        pattern: ["judge", "escalate_to"],
+        reason: "the re-run's forced arm is a roster decision",
+    },
+    // -- budget: spend policy, whole block --
+    { pattern: ["budget", "usd"], reason: "the run cap is human-owned spend policy" },
+    { pattern: ["budget", "judge_share"], reason: "a spend split is human-owned policy" },
+    {
+        pattern: ["budget", "scope"],
+        reason: "run vs session bounds a cap's blast radius — an operator's call",
+    },
+    {
+        pattern: ["budget", "on_exceed"],
+        reason: "what happens at the cap (stop / degrade to a model) is roster and spend policy",
+    },
+    // -- sub-agents: a tool-surface / identity block, wholesale --
+    {
+        pattern: ["sub_agents"],
+        reason: "a sub-agent definition is tool surface, identity and (0.6.0) its own routing, budget share, inheritance and profile allowlist — human-owned wholesale",
+    },
+    // -- MCP trust flags, crew router model --
+    {
+        pattern: ["tool_flags"],
+        reason: "MCP trust flags narrow a tool's trust posture — security surface",
+    },
+    {
+        pattern: ["routing", "model"],
+        reason: "the crew llm router's model is a roster decision",
+    },
+    // -- observability.slo: production alerting and mitigation thresholds --
+    {
+        pattern: ["observability", "slo"],
+        reason: "an SLO threshold decides when production is alerted, paused or rolled back — an operator's call, never an eval loop's (the routing rates added in 0.6.0 follow the existing keys)",
+    },
+]);
+/** A leaf path is human-owned when some {@link HUMAN_OWNED_PATHS} row matches it. */
+export function humanOwnedReason(path) {
+    for (const row of HUMAN_OWNED_PATHS) {
+        if (containsPattern(path, row.pattern))
+            return row.reason;
+    }
+    return undefined;
+}
+/** One segment of a pattern against one segment of a path (`"*"` matches any one segment). */
+function segmentMatches(pattern, actual) {
+    return pattern === WILDCARD_SEGMENT || pattern === String(actual);
+}
+/** `pattern` appears as a contiguous sub-sequence of `path` (wildcards honoured). */
+function containsPattern(path, pattern) {
+    if (pattern.length === 0 || pattern.length > path.length)
+        return false;
+    outer: for (let start = 0; start + pattern.length <= path.length; start++) {
+        for (let i = 0; i < pattern.length; i++) {
+            if (!segmentMatches(pattern[i], path[start + i])) {
+                continue outer;
             }
         }
-        if (match)
-            return true;
+        return true;
     }
-    // Allow patches with a prefix that matches an optimizable path
-    // (e.g. `["nodes", "0", "instructions"]` if `["nodes"]` is whitelisted)
-    // so the optimizer can do fine-grained updates without listing every
-    // sub-path.
-    for (const ok of allowed) {
-        if (path.length < ok.length)
-            continue;
-        let match = true;
-        for (let i = 0; i < ok.length; i++) {
-            if (ok[i] !== path[i]) {
-                match = false;
-                break;
+    return false;
+}
+/** `entry` matches the first `entry.length` segments of `path` (wildcards honoured). */
+function entryIsPrefixOf(entry, path) {
+    if (path.length < entry.length)
+        return false;
+    for (let i = 0; i < entry.length; i++) {
+        if (!segmentMatches(entry[i], path[i]))
+            return false;
+    }
+    return true;
+}
+/**
+ * The wildcard placement guard (plan §10.3, mechanism 1): every issue is a
+ * whitelist entry that would let `"*"` sit above a human-owned key. Returns
+ * `[]` for the shipped table — pinned by the spec-patch tests, so a future
+ * entry that breaks the rule fails CI rather than widening the surface.
+ */
+export function wildcardPlacementIssues(table = OPTIMIZABLE_PATHS) {
+    const issues = [];
+    for (const [target, entries] of Object.entries(table)) {
+        for (const entry of entries) {
+            const stars = entry.filter((seg) => seg === WILDCARD_SEGMENT).length;
+            if (stars === 0)
+                continue;
+            const label = `${target}: [${entry.join(", ")}]`;
+            const last = entry[entry.length - 1];
+            if (last === WILDCARD_SEGMENT) {
+                issues.push(`${label} ends in a wildcard — it would admit a whole dynamic subtree by prefix`);
+                continue;
+            }
+            if (WILDCARD_FORBIDDEN_LEAVES.includes(last)) {
+                issues.push(`${label} terminates in the human-owned key "${last}" under a wildcard — the §10.3 table excludes it`);
+            }
+            // `temperature` is the one structural segment that is a scalar LEAF (it
+            // is structural to block the prefix route, not because it is a block),
+            // so a wildcard entry may terminate in it; the block segments may not.
+            if (STRUCTURAL_SEGMENTS.includes(last) && last !== "temperature") {
+                issues.push(`${label} terminates in the structural block "${last}" under a wildcard — a structural block is never whitelisted wholesale`);
+            }
+            if (entry.length < 3) {
+                issues.push(`${label} is too short to name a dial — a wildcard entry needs a concrete parent AND a concrete leaf`);
             }
         }
-        if (match)
+    }
+    return issues;
+}
+/**
+ * The single admission rule behind `validatePatch`, `applySpecEdits({
+ * restrictToOptimizable })`, the Hangar spec editor's trust badge, the
+ * feedback / watch-me advice tiers and the orchestrator's stage guard:
+ *
+ *   1. an EXACT match against a listed entry admits the path (wildcards
+ *      match one segment each);
+ *   2. a path through a STRUCTURAL segment ({@link STRUCTURAL_SEGMENTS}) is
+ *      admitted by exact match ONLY — never by prefix;
+ *   3. otherwise a listed entry that is a PREFIX of the path admits it
+ *      (`["nodes","0","instructions"]` under `["nodes"]`), so the optimizer
+ *      can make fine-grained updates without listing every sub-path.
+ *
+ * Exported so every consumer shares one matcher — a hand-rolled prefix copy
+ * would neither honour the wildcard nor close the structural leak.
+ */
+/**
+ * 0.6.0 §6.1 (PR 12) — the leaves the whitelist admits BY PREFIX but the
+ * optimizer must never move, matched as a contiguous sub-sequence anywhere in
+ * a path (the {@link HUMAN_OWNED_PATHS} matcher) and ENFORCED by
+ * {@link isOptimizable}.
+ *
+ * There is exactly one row, and it exists because `model_pool.learning` is
+ * deliberately whitelisted WHOLESALE: `crewhaus advise` mines the reward
+ * scoreboard into that block and patches it AS a block, so a narrower
+ * enumeration would break the advisor. PR 19 shipped the verdict table with
+ * the `learning.seed` exclusion documented as an accepted gap "until the eval
+ * runner (PR 12) needs it"; it needs it now — a routed eval PINS
+ * `learning.seed`, so an optimizer free to patch the seed could produce a
+ * measured delta of guaranteed zero, the one mutation that always "wins"
+ * because it changes nothing the measurement can see.
+ *
+ * This is an enforcement narrower than the whitelist, NOT a second
+ * classification: the `learning` BLOCK stays legitimately optimizable (which
+ * is what §10.3's verdict table and its closing-invariant test record), and
+ * `validatePatch` additionally refuses a block patch that would CHANGE the
+ * seed — a block patch that preserves it, as the advisor's spread does,
+ * passes.
+ */
+export const OPTIMIZER_REFUSED_LEAVES = Object.freeze([
+    Object.freeze(["model_pool", "learning", "seed"]),
+]);
+/** True when `path` contains one of {@link OPTIMIZER_REFUSED_LEAVES} as a contiguous run. */
+function isRefusedLeaf(path) {
+    const segs = path.map((s) => String(s));
+    return OPTIMIZER_REFUSED_LEAVES.some((pattern) => segs.some((_s, i) => pattern.every((p, j) => segs[i + j] === p)));
+}
+export function isOptimizable(target, path) {
+    // 0.6.0 §6.1 — the enforced refusals win over every admission rule below.
+    if (isRefusedLeaf(path))
+        return false;
+    const allowed = OPTIMIZABLE_PATHS[target];
+    if (allowed === undefined || path.length === 0)
+        return false;
+    for (const ok of allowed) {
+        if (ok.length === path.length && entryIsPrefixOf(ok, path))
+            return true;
+    }
+    // The structural rule (see STRUCTURAL_SEGMENTS): past this point only a
+    // PREFIX match can admit the path, and a path through a human-owned
+    // structural block is never admitted by prefix.
+    if (path.some((seg) => typeof seg === "string" && STRUCTURAL_SEGMENTS.includes(seg))) {
+        return false;
+    }
+    for (const ok of allowed) {
+        if (entryIsPrefixOf(ok, path))
             return true;
     }
     return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/spec-patch",
-  "version": "0.5.7",
+  "version": "0.6.0",
   "type": "module",
   "description": "Pillar-2 patch infrastructure — apply a SpecPatch to a YAML source preserving comments and key order via the yaml CST. Drives the active eval optimizer's spec-level mutation loop.",
   "main": "dist/index.js",
@@ -15,8 +15,8 @@
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/errors": "0.5.7",
-    "@crewhaus/spec": "0.5.7",
+    "@crewhaus/errors": "0.6.0",
+    "@crewhaus/spec": "0.6.0",
     "yaml": "^2.6.0",
     "zod": "^3.23.8"
   },